Effective date: 26 August 2026 · Date of notice: 26 August 2026 · Version 1.0
This is the Company's published notice. If its contents change, the Company will announce the changes and their effective date in advance. Processing for PigSignal Purpose ② (provision of anonymized/aggregated statistics to third parties) remains inactive (OFF) until the separate execution gates are satisfied.
WiseLake Inc. (hereinafter the "Company") complies with the personal data protection laws of each country applicable to the Company, including the "Personal Information Protection Act," and establishes and discloses this notice in order to protect the personal data of Data Subjects who use the PigOS service (hereinafter the "Service").
① Personal data controller: WiseLake Inc. (Republic of Korea) ② Data Protection Officer:
| Category | Name | Affiliation·Title | Contact |
|---|---|---|---|
| Privacy Officer (개인정보 보호책임자) | Gyomoon Jin (진교문) | WiseLake Inc. / Chief Executive Officer | wiselake@wiselake.ai / +82-31-421-3418 |
| Privacy Department (개인정보 보호 담당부서) | Management Support Team (경영지원팀) | WiseLake Inc. | wiselake@wiselake.ai / +82-31-421-3418 |
③ Where the designation of a local representative or agent is required on a country-by-country basis (e.g., an EU/GB representative, a local representative in Thailand, etc.), such information shall be stated in the Country-specific Notice.
The Company processes the following items in order to provide the Service. The collection method for each item (direct input / automatic collection / generation) is as set out in the table below.
| Classification | Items | Collection Method |
|---|---|---|
| Account·login identification information | Name, email, mobile phone number, ID, password (stored with protective measures applied, such as a secure one-way hash), affiliated company·farm name, position·department | Direct input |
| Organization·permission information | Affiliated organization, affiliated farm, user permissions (Organization Administrator/Farm User), invitation·permission change history | Direct input·generation |
| Device·environment information | IP address, device identifier, device model, OS and version, app version, browser information | Automatic collection |
| Access·usage logs | Access date and time, usage records, feature use history, error logs | Automatic collection |
| Cookie·analytics identifiers | Cookies, analytics identifiers (online identifiers generated by analytics tools such as Google Analytics) | Automatic collection (Article 6) |
| Farm Production Records | Mating·farrowing·weaning·mortality records, individual and group management data for sows·piglets·boars, husbandry·performance data | Direct input·integration |
| KPI·notification information | Production indicators (KPI), reports, notification settings·receipt history | Generation |
| AI input·output | Data·queries entered into AI features, alerts·insights·recognition results generated by AI | Direct input·generation |
| Uploaded images·documents | Photographs uploaded by Members, performance report·document images (including those subject to OCR) | Direct input |
| Offline synchronization information | Temporary stored copies of offline-entered data, synchronization time·status·conflict resolution records | Automatic collection·generation |
| Region·language settings | Country, language, time zone settings | Direct input·automatic collection |
| Payment·credit information | Payment method information (processed by the Payment Gateway), payment·refund history, Credits purchase·deduction·expiration history | Direct input·generation |
| Customer support information | Consultation·inquiry content, handling history | Direct input |
② Classification by collection status: Whether and when the above items are actually collected is distinguished as follows. Items that may be introduced in the future are not listed under [Currently Collected] until they are actually introduced and notified.
| Collection Category | Items (examples) | Actual-measurement Flag |
|---|---|---|
| [Currently Collected] — collected at all times when using the Service | Account·login identification information (including mobile phone number), organization·permission information (including permission change history), device identifier·device·environment information, access·usage logs, cookie·analytics identifiers, Farm Production Records·KPI, region·language settings, customer support information | |
| [Collected When Feature Is Used] — collected only when the relevant feature is used | AI input·output (when AI features are used — not stored on Company servers), offline synchronization temporary stored copies (when offline mode is used) | |
| [Planned for Future Collection — Not Included in the Notice] — not currently collected. Upon actual introduction, to be collected after amendment of the notice·separate notification (and consent where necessary) | Advertising identifiers (no advertising SDK is embedded), payment·credit information (payment features have not commenced), uploaded images·OCR documents (feature has not commenced), and items to be reviewed upon business expansion such as insurance·credit·lending·transaction-matching related items | |
| [Not Collected] | Information of children under 14 years of age (a non-target Service — Article 5), sensitive data such as thoughts·beliefs·health (not collected without separate specification·consent), precise location information (farm coordinates) — there is no collection screen or API path, and the mobile applications do not declare location permissions at all. Residual columns from an earlier design remain in the database but hold no values |
③ Farm data such as Farm Production Records may not constitute personal data in the case of corporate farms; however, in the case of sole-proprietor (natural person) farms, it may be treated as personal data, and therefore the Company conservatively applies the protection level of this notice.
① The Company processes personal data and Farm Data for the following six purposes. The legal basis for each purpose shall be based by default on the master standard in the table below; provided that the divergence of legal bases by country (in particular Purpose ②) is determined in the Country-specific Notice, which shall prevail.
| Purpose | Processing Content | Master-standard Legal Basis | Consent Structure |
|---|---|---|---|
| ① Service operation (mandatory) | Account creation·management, provision of Core·AI features, payment·credit settlement, synchronization, security, customer support, fulfillment of statutory obligations | Conclusion·performance of a contract, legal obligation | No consent required (mandatory notice) |
| ② Anonymized·aggregated statistics (default) | Anonymization·aggregation processing of Farm Data and provision of Anonymized Statistical Output (PigSignal) to third parties — including provision for consideration (sale) | In accordance with the Country-specific Notice (e.g., KR — anonymized-information legal doctrine + notice·exclusion request / EU·GB — legitimate interest + notice·right to object, etc.) | Country-by-country divergence + right to request exclusion guaranteed at all times |
| ③ AI model training (optional) | Improvement of AI features·model training using Member data | Consent | Separate opt-in, OFF by default |
| ④ Provision to a specific enterprise for research (optional) | Provision of data for the research purposes of a specific third party | Consent | Separate opt-in, OFF by default |
| ⑤ Transaction matching·lead provision (optional) | Provision of business-counterparty matching·leads including identifying information | Consent (notice of the recipient·purpose·items·retention period) | Separate opt-in, OFF by default |
| ⑥ External AI processing | External AI entrusted processing for the provision of features such as PigOS AI answer generation and document image recognition (OCR) (entails cross-border transfer) | Processing delegation (performance of a contract) — disclosure under Article 8 | Prior separate consent (separate consent where training is also involved) |
② Consent for Purposes ③④⑤ is obtained through individual toggles for each purpose, and there is no disadvantage to using the Service even if consent is not given. Consent may be withdrawn at any time in the Service settings. ③ The procedure for requesting exclusion in respect of Purpose ② and the treatment of Anonymized Statistical Output that has already been provided (exclusion of retroactive recall limited to irreversibly anonymized outputs ) are as set out in Article 10 of the Terms of Service. ④ In anonymizing, the Company applies removal of identifying information, control of the minimum aggregation unit, suppression·merging of sparse cells, etc., processes the data such that re-identification is not possible when reasonably considered, and contractually prohibits·blocks re-identification attempts by the receiving institution. The appropriateness of anonymization is periodically re-evaluated through an internal review procedure (with external experts where necessary).
The Company does not currently automatically make decisions that produce legal or similarly significant effects on the rights·contractual status of users based on AI output alone. The alerts·insights·recognition results produced by AI features are provided as reference information that assists the user's judgment. Where the Company in the future uses AI output for purposes that may have a significant effect on users, such as insurance·credit·loans·transaction matching, the Company shall reconsider whether such processing constitutes automated decision-making and shall implement additional safeguards required by the applicable law, such as notice·explanation·objection·human intervention.
① In addition to collecting personal data directly from Data Subjects, the Company may receive and process personal data indirectly from the following sources.
| Source | Information Provided (examples) | Actual-measurement Flag |
|---|---|---|
| Organization Administrator·Farm Owner | Account identification information, affiliation·permission information of employees·contract farmers·users |
② Where an Organization Administrator·Farm Owner·Integrator enters the personal data of its employees or contract farmers into the Service, the responsibility for securing a lawful basis for the collection·processing of, and for notifying, such Data Subjects lies in principle with the relevant organizational customer, and the roles between the Company and the organizational customer are determined in Article 7 and in a separate B2B Data Processing Addendum (DPA). ③ Duty to give notice of indirect collection: In countries that require the Data Subject to be notified of the fact·source·items, etc., of personal data collected from sources other than the Data Subject, such as the EU·GB, the Company or the relevant organizational customer shall give notice in accordance with the deadline·method prescribed by the applicable law (e.g., Article 14 of the GDPR·UK GDPR), and the specific procedure·allocation of responsibility shall be determined in the Country-specific Notice and the B2B DPA.
① The Service is not directed at children under 14 years of age (or children below the age prescribed by the applicable law), and the Company does not intentionally collect the personal data of such children. ② If the Company becomes aware that the personal data of a child has been collected without the consent of a legal guardian, it shall destroy such data without delay. Special provisions on age standards·consent procedures by country shall follow the Country-specific Notice.
① The Company uses cookies and similar technologies on the Service website and app to automatically collect access·usage information. ② Analytics tools used by the Company:
| Tool | Provider | Information Collected | Purpose |
|---|---|---|---|
| Google Analytics | Google LLC (USA) | Cookies·online identifiers, access·usage statistics | Service usage analysis·improvement |
| Other analytics·error-collection tools | — | — | None currently adopted — upon adoption, this table will be updated and notified in advance |
③ Means of refusal: Users may refuse automatic collection through (i) refusing·deleting cookie storage via browser settings, (ii) the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout), and (iii) the cookie settings tool provided by the Service (where provided). ④ Prior consent for non-essential analytics cookies (EU·GB, etc.): In countries that require prior consent (opt-in) before execution for non-essential analytics·measurement cookies (including Google Analytics), such as the EU·GB, the Company shall, through a consent management platform (CMP) or cookie banner, block the execution of non-essential tags such as Google Analytics until consent is obtained, obtain consent on a country-by-country basis, manage the consent·withdrawal history as logs, and deactivate the relevant tags upon withdrawal. Signups for such jurisdictions are not currently open. ⑤ Where cookie storage is refused, the use of some features may be restricted.
① The Service is a B2B-type service used jointly by individual users and enterprise·organizational customers, and depending on the type of processing, the roles of the Company (WiseLake) and the enterprise customer under personal data protection law (personal information controller / processor / joint controller) may differ. The table below sets out the roles currently expected. The allocation of roles under this Article is under legal review; upon confirmation the Company will amend and notify this Notice in accordance with Article 15 (Amendment and Notification of this Notice).
| Type of Processing | Anticipated Role |
|---|---|
| Sign-up·account management, payment·credit settlement, security, Service usage analysis·improvement | WiseLake = personal data controller (controller) |
| Enterprise·organizational customer entering·managing the personal data of its own employees·contract farmers in the Service | Enterprise customer = controller, WiseLake = processor (processor) possible — B2B DPA applies |
| Processing for the purpose of producing·providing Anonymized·aggregated statistics (PigSignal) | WiseLake = controller, or, depending on the data-contribution·purpose-setting structure, joint controller possible |
| Provision of data for the research purposes of a specific enterprise (Purpose ④) | Joint controller possible depending on the contract structure — determined by whether the purpose·means are jointly decided |
② Where the Company processes personal data as a processor of an enterprise customer, the processing conditions such as the limitation of processing instructions, sub-processors, security measures, support for Data Subject rights, deletion·return, and cross-border transfer are determined in a separate B2B Data Processing Addendum (DPA). ③ Where the parties constitute joint controllers, the scope of each party's responsibilities·the Data Subject contact point are determined in accordance with the relevant contract and the applicable law (e.g., Article 26 of the GDPR), and the essence thereof is notified to the Data Subject.
① The Company's Service servers are located within the Republic of Korea. Where a user in a country other than the Republic of Korea uses the Service, that user's personal data is transferred to and processed·stored in the Republic of Korea, and this fact and its basis are disclosed in detail in the Country-specific Notice. ② The Company delegates the processing of personal data as follows for the provision of the Service, and upon concluding the delegation contract it stipulates prohibition of re-identification·prohibition of use beyond the purpose·safety measures, etc., and supervises the processor.
| Processor | Delegated Work | Country of Processing | Remarks |
|---|---|---|---|
| Anthropic PBC (Claude API) | Natural-language generation of PigOS AI answers — phrasing the analysis produced by the Company's rule engine (AI Insight add-on) | United States | Cross-border transfer — made only where the user has given prior separate consent. Items transferred: the indicator (KPI) involved with its current and target value, the severity and reference date of the finding, the causes and recommended actions produced by the rule engine, and the ear tag of the animal where a finding concerns one specific animal. The user's question text, identifying information such as name·email, account·farm identifiers, photographs, voice recordings and source database records are not transferred. Time·method of transfer: at the moment the user asks a question, transmitted over an encrypted connection (TLS) via the API; the Company does not separately store it. Purpose of use: generation of that answer only. Retention·use period: retained by the transferee only for the time required to generate the response; use for its own model training is contractually prohibited. Where consent is withheld or withdrawn, and for farms not using the AI Insight add-on, answers are generated by the Company's rule engine alone and no transfer occurs. Transferee contact: privacy@anthropic.com |
| Google LLC | Usage analytics (Google Analytics) — limited to the marketing website (pigos.io); not applied to the Service application | United States, etc. | See Article 6 |
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure operation, data storage·backup | Republic of Korea (Seoul region) | Domestic region — does not constitute a cross-border transfer |
| Payment Gateway (PG) | Paid payment processing | — | No processing currently entrusted — paid payments have not commenced. Upon commencement, this table will be updated and notified in advance |
③ Where the delegated processing entails cross-border transfer, the Company discloses, through this Article and the Country-specific Notice, the items transferred, the country of transfer, the date·method of transfer, the name·contact of the transferee, the purpose of use, and the retention·use period, and where the applicable law requires separate consent or additional safeguards (conclusion of Standard Contractual Clauses, transfer impact assessment, etc.), it implements them. ④ Where a processor re-transfers the processing work to a third country, the Company reflects that fact in the table of this Article and gives notice thereof. ⑤ Use by an external AI processor of the transferred data for its own model training is contractually prohibited, and features that inevitably entail training use are provided upon obtaining separate consent.
① As a matter of principle, the Company destroys personal data once the purpose of collection·use is achieved. Item-by-item retention·deletion criteria are set out in the table below. This Notice does not state arbitrary long-term retention periods; for items for which no period is stated below, the Company will amend and notify this Notice once the retention·deletion policy is established.
| Item | Retention·Deletion Standard |
|---|---|
| Account information (identification·login·organization·permission) | Upon Member withdrawal or achievement of the purpose, identifying information is destroyed so that the individual can no longer be identified. Items subject to a statutory retention obligation are governed by Paragraph 2. |
| Farm source data (production records·individuals·performance) | Retained during the use period. Upon withdrawal the farm is deactivated; return·deletion of organizational-customer data follows the B2B DPA. |
| Offline local temporary stored copies | Stored on the user’s device and deleted from the device upon completion of synchronization or deletion of app data. |
| AI input·output | Not stored on Company servers. Training use (Purpose ③) is limited to the scope of separate consent. |
| Access·security logs | Website visit records (access logs) are retained for 3 months (Protection of Communications Secrets Act). |
| Customer support records | Records concerning consumer complaints and dispute resolution are retained for 3 years (Paragraph 2). |
| Backup data | Sequentially renewed·deleted according to the backup rotation cycle; backup remnants after deletion of the original are also deleted within the rotation cycle. |
| Consent history (consent ledger) | Retained after the end of processing, to the extent permitted·required by applicable law, in order to evidence consent·withdrawal. |
| Payment·tax·statutory retention items | The statutory period under Paragraph 2 |
② Items subject to a statutory retention obligation are retained separately from other personal data for the period prescribed by the relevant law and are not used beyond the retention purpose. The retention table under Republic of Korea law is as follows, and the statutory retention obligations of other countries are stated in the Country-specific Notice.
| Item | Retention Basis (KR) | Retention Period |
|---|---|---|
| Records on contracts or withdrawal of subscription, etc. | Act on the Consumer Protection in Electronic Commerce, etc. | 5 years |
| Records on payment settlement and supply of goods, etc. (including payment·credit transactions) | Act on the Consumer Protection in Electronic Commerce, etc. | 5 years |
| Records on consumer complaints or dispute resolution | Act on the Consumer Protection in Electronic Commerce, etc. | 3 years |
| Website visit records (access logs) | Protection of Communications Secrets Act | 3 months |
| Books and supporting documents concerning transactions under tax law | Framework Act on National Taxes, Article 85-3 | 5 years |
③ Treatment of Anonymized Statistical Output: Statistical output that, prior to a Member's withdrawal, has already been irreversibly anonymized in accordance with the standards of Article 10, Paragraph 6 of the Terms of Service constitutes information from which a specific individual cannot be identified and does not constitute personal data, is not subject to the retention·destruction provisions of this Article, and may continue to exist. Source farm data and personal data for which anonymization has not been completed are processed in accordance with Paragraphs 1·2. ④ Method of destruction: Electronic files are deleted by technical means that make recovery·reproduction impossible, and printouts are shredded or incinerated.
① A Data Subject (the user and, where applicable, the legal guardian) may exercise the following rights against the Company at any time.
② Rights may be exercised through the account management feature within the Service, in writing, by email (wiselake@wiselake.ai), etc., and the Company shall take action without delay within the period prescribed by the applicable law and notify the result. Where rights are exercised through an agent, the Company may require lawful proof of delegation. ③ Upon receiving a request for correction or deletion, the Company shall not use or provide the relevant personal data until the processing is completed, and where personal data already provided to a third party contained errors, it shall notify the correction result to that third party without delay. ④ Where the exercise of rights is restricted under the applicable law, such as for information subject to a statutory retention obligation or output that has already been irreversibly anonymized (Article 9, Paragraph 3 ), the Company shall notify the reasons therefor. ⑤ The exercise of a Data Subject's rights in respect of personal data processed by the Company as a processor of an enterprise customer (Article 7) is, as a matter of principle, carried out through the relevant organizational customer (controller), and the Company supports this in accordance with the B2B DPA. ⑥ Rights that are expanded on a country-by-country basis and their exercise procedures (including procedures for appeal to the supervisory authority), such as access·deletion·portability (right to data portability)·objection, are determined in the Country-specific Notice.
The Company takes the following technical·managerial·physical measures.
Where the Company becomes aware of the loss·theft·leakage of personal data, it shall, in accordance with the deadline and method prescribed by the applicable law, notify the Data Subject of the fact·circumstances·method of minimizing damage, report to the competent authority, and establish·implement measures to prevent recurrence.
Where the Company transfers all or part of its business, or transfers the rights·obligations relating to personal data processing through a merger, etc., it shall give prior notice of that fact and of the name·contact of the successor by the method prescribed by the applicable law.
① The Company provides additional notices for compliance with the laws of each country·region (divergence of legal bases, expanded Data Subject rights, local representatives, supervisory authority contacts, additional safeguards for cross-border transfer, indirect-collection notice, etc.) as the Country-specific Notice (COUNTRY_ADDENDA — Privacy). ② Where the Country-specific Notice applicable to the country to which a user belongs conflicts with this notice, the Country-specific Notice shall apply with priority as to that user. ③ Matters not provided for by the Country-specific Notice are governed by this notice.
① Where the content of this notice is added·deleted·modified, the Company shall give notice at least 7 days before enforcement (at least 30 days before, where there is a significant change to user rights) through the Service announcement or individual notification. ② The Company shall at all times post the date of notice·effective date and the revision history at the bottom of the notice, and shall make previous versions available for review. ③ Matters requiring separate consent as a new processing purpose are not substituted by a notice-amendment announcement, and separate individual consent for the relevant purpose is obtained.
Data Subjects may contact the supervisory authority of the competent country for reporting·consultation regarding personal data infringement. In the case of the Republic of Korea, these are as follows, and information on the supervisory authorities of other countries is stated in the Country-specific Notice.
Supplementary Provisions